Fundamentals of AI Security, AI Governance & AI Compliance

Common AI security risks include adversarial machine learning attacks, data poisoning, model manipulation, prompt injection, sensitive data exposure, model theft, insecure APIs, compromised third-party models, and vulnerabilities in generative AI and autonomous AI agents.

AI systems can also introduce risks that traditional cybersecurity programs may not fully address because models can change behavior based on data, prompts, context, and deployment conditions. The course covers AI attack surfaces, adversarial machine learning, LLM security, agentic AI risks, and AI defense engineering.

An AI governance framework is a structured system of policies, responsibilities, controls, risk-management processes, documentation, monitoring, and oversight used to manage AI throughout its lifecycle.

A strong framework helps organizations determine who is responsible for AI systems, which uses require approval, how risks are assessed, what documentation should be retained, how systems are monitored, and when human intervention is necessary.

Read our beginner-friendly guide to AI governance frameworks for a deeper explanation.

AI governance is the broader organizational system for controlling how AI is selected, developed, deployed, monitored, and retired.

AI compliance focuses more specifically on meeting applicable laws, regulatory requirements, standards, contractual obligations, and internal policies.

For example, an organization may create an AI governance committee, approval process, risk register, and monitoring program as part of its governance system. Compliance teams then assess whether those controls meet requirements under frameworks or regulations relevant to the organization.

Traditional cybersecurity primarily protects information systems, networks, applications, devices, and data against threats to confidentiality, integrity, and availability.

AI security must also consider risks specific to machine learning and generative AI, including model manipulation, adversarial inputs, poisoned training data, prompt injection, model extraction, hallucination-related risks, and vulnerabilities created by autonomous or agentic systems.

Because AI is adaptive and highly dependent on data and context, organizations increasingly need security controls that operate throughout the AI lifecycle rather than only around traditional IT infrastructure.

The NIST AI Risk Management Framework (NIST AI RMF) is a voluntary framework designed to help organizations manage risks associated with artificial intelligence.

Its core is organized around four functions: Govern, Map, Measure, and Manage. These functions help organizations establish accountability, understand AI use cases and impacts, assess risks, and implement appropriate risk responses.

For professionals who want to study the framework in greater depth, see our NIST AI Risk Management Framework In Practice course.

ISO/IEC 42001:2023 is an international standard for establishing, implementing, maintaining, and continually improving an Artificial Intelligence Management System, or AIMS.

It provides organizations with a structured management-system approach to AI policies, objectives, responsibilities, risk management, operational controls, monitoring, and continual improvement.

You can learn more in our ISO/IEC 42001 explained guide or explore the dedicated ISO 42001:2023 Fundamentals course.

Both help organizations manage AI risk, but they serve different purposes.

The NIST AI RMF is a voluntary risk-management framework organized around Govern, Map, Measure, and Manage. ISO/IEC 42001 is a formal AI management-system standard containing requirements for establishing and continually improving an organizational AI management system.

Organizations may use the two together rather than treating them as competing approaches.

For more specialized training, our AI Risk Management with NIST and ISO 42001 course explores how these frameworks can support structured AI risk governance.

Yes. Fundamentals of AI Security, AI Governance & AI Compliance introduces the EU AI Act as part of its module on global AI regulation and compliance frameworks. It also covers risk-based AI classification and wider regulatory approaches across the United States, UK, China, GCC, and other jurisdictions.

The EU AI Act follows a risk-based regulatory model, with requirements varying according to the type and risk level of the AI system.

For a more detailed regulatory overview, read our EU AI Act Compliance: Requirements, Risk Categories and Checklist.

An AI risk assessment typically begins by identifying the AI system and its intended use, mapping affected people and data, identifying possible security, privacy, fairness, safety, operational, and compliance risks, evaluating their severity and likelihood, documenting controls, and establishing ongoing monitoring.

Risk assessments should also consider third-party AI tools, vendors, APIs, generative AI applications, and unauthorized AI use within the organization.

Our step-by-step guide on How to Conduct an AI Risk Assessment explains the process in more detail.

LLM security focuses on protecting large language model applications from risks arising during development, integration, deployment, and use.

Examples include prompt injection, sensitive information disclosure, insecure integrations, manipulated inputs, unauthorized actions, model abuse, and vulnerabilities created when an LLM can access external tools or business systems.

The Fundamentals of AI Security, AI Governance & AI Compliance course includes dedicated coverage of generative AI, LLM security, and agentic system risks.

Agentic AI systems can operate with greater autonomy than conventional AI applications. Depending on their permissions, they may interact with software, access information, call tools, execute multi-step tasks, or make decisions without constant human input.

This creates governance and security concerns around excessive permissions, manipulated instructions, unintended actions, access control, monitoring, accountability, and human intervention.

Organizations deploying AI agents therefore need clear authorization boundaries, monitoring, audit trails, security controls, and escalation mechanisms.

Shadow AI refers to AI applications or tools being used within an organization without appropriate approval, visibility, or governance.

Employees may use public generative AI tools, browser extensions, AI APIs, or AI-enabled software without realizing that confidential information, personal data, intellectual property, or business information could be exposed.

Organizations can reduce Shadow AI risk through AI inventories, acceptable-use policies, approved-tool lists, access controls, vendor assessment, employee training, monitoring, and incident-response procedures.

For deeper coverage, see our Shadow AI: AI Risk Management and Governance course.

Useful AI governance documentation can include:

• AI system inventories
• Risk and impact assessments
• Model or system documentation
• Approval records
• Data governance records
• Testing and validation evidence
• Human oversight procedures
• Vendor assessments
• Monitoring records
• Incident records
• Audit trails
• Policies and operating procedures

Documentation helps organizations demonstrate how AI risks and decisions are being managed throughout the system lifecycle.

Our guide to AI Documentation: What Your Business Should Keep explores this topic in greater detail.

An AI audit is a structured examination of an AI system and the controls surrounding it. Depending on its purpose, an audit may review governance, risk management, security, fairness, transparency, documentation, human oversight, data practices, monitoring, or compliance.

AI auditability depends heavily on having sufficient documentation, logs, assigned responsibilities, testing evidence, and traceable decision-making processes.

This course introduces AI auditability and documentation as part of its AI operations and monitoring curriculum.

An AI incident is generally an event in which the development, use, or malfunction of an AI system results in harm or other significant adverse consequences.

Examples can involve discriminatory outcomes, privacy violations, unsafe behavior, misleading AI outputs, security failures, or failures affecting people or organizations.

Businesses should establish procedures for identifying, documenting, investigating, escalating, and learning from AI incidents. Read What Is an AI Incident? for a more detailed explanation.

A responsible AI governance program usually combines:

• Clear AI policies
• Defined roles and accountability
• An inventory of AI systems
• Risk classification
• AI risk and impact assessments
• Security and privacy controls
• Human oversight
• Vendor governance
• Documentation
• Monitoring and auditing
• Incident management
• Employee AI training
• Continuous improvement

Recognized frameworks such as NIST AI RMF and ISO/IEC 42001 can provide additional structure.

Our Responsible AI: Complete Guide to AI Ethics, Governance & Compliance provides a broader roadmap for organizations.

This course is relevant to professionals involved in:

• AI governance
• Cybersecurity and information security
• Risk management
• Compliance
• Internal audit
• Data governance
• Privacy
• AI procurement
• Responsible AI
• Digital transformation
• Technology leadership

It is also suitable for managers who need to understand how AI security, governance, risk, and compliance fit together without becoming AI engineers.

No specific prior qualifications or professional experience are required for Fundamentals of AI Security, AI Governance & AI Compliance.

The course is designed as foundational training and can be taken by learners interested in AI governance, cybersecurity, compliance, risk management, ethics, information security, or digital transformation.

No. Effective AI governance is cross-functional.

Technical teams may handle model architecture, security testing, data engineering, and system monitoring, while compliance, legal, privacy, risk, procurement, audit, HR, and senior management may handle policies, risk decisions, vendor oversight, documentation, accountability, and regulatory requirements.

Professionals who want a broader introduction can also explore our AI Governance Fundamentals course.

Knowledge of AI security, governance, compliance, and risk management can support professional development in areas such as:

• AI Governance
• AI Risk Management
• Responsible AI
• AI Compliance
• AI Security
• Information Security
• Technology Risk
• Internal Audit
• Data Governance
• AI Assurance
• Digital Transformation

Actual job requirements vary significantly by employer and role, and advanced technical AI security positions may require additional cybersecurity, machine learning, or software engineering expertise.

Yes. Learners who successfully complete Fundamentals of AI Security, AI Governance & AI Compliance receive a certificate of completion.

The certificate demonstrates completion of structured training covering AI security, governance, compliance, risk management, trust engineering, fairness, accountability, monitoring, auditability, and global regulatory frameworks.

The course is approximately 2.5 hours long and is delivered online in English. The current curriculum contains seven sections, including six learning modules, each modules have quiz included, plus a final quiz, and covers AI risk, security, ethics, governance, compliance frameworks, monitoring, and auditability.

Yes. The course is designed for both individual professionals and organizational teams that need foundational knowledge of AI security, AI governance, AI compliance, AI risk management, monitoring, and responsible AI controls.

It can be particularly relevant for compliance, security, audit, risk, governance, procurement, and leadership teams involved in AI adoption.